xloader | c05c2e532b550a79508842fe8f4ab75316c86752bebd912ac84eaed0cdb4ebf4

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
02-07-2024 00:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1d2ebab3ed572cc11daf9d4ff90b5e0c_JaffaCakes118.exe
Size

614KB
MD5

1d2ebab3ed572cc11daf9d4ff90b5e0c
SHA1

b3ad1752b059ed8ea2f747ef6c07035c9990aca4
SHA256

c05c2e532b550a79508842fe8f4ab75316c86752bebd912ac84eaed0cdb4ebf4
SHA512

a2c644c5a78307c7f09f6de7dfef5768063918362ae4de8d6760f63679e1f617a7a86149c0f27a43471e818f1bef0d0852df9ee85853e7417d9115dff42ea463
SSDEEP

12288:foNNbQ+X8+UiDLbRHahRyMgtPDwd+0J5rRUqRBEOyMn8oyx:MbQ+X8+UiDLbRHahRiP0d+0PReBKs

Score

10^/10

xloader shjn loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

shjn

Decoy

trendlito.com

myspoiledbytchcreations.com

skinsotight.com

merakii.art

sakina.digital

qumpan.com

juxing666.com

andrewolivercounselling.com

blastaerobics.com

linevshaper.store

legendvacationrentals.com

adna17.com

ingodwetrustdaycare.com

j98066.com

noordinarybusiness.com

pacelicensedelectrician.com

istanbulmadencilik.com

roboscop.com

njhude.com

eaglelures.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2664-14-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

1d2ebab3ed572cc11daf9d4ff90b5e0c_JaffaCakes118.exe

description	pid	Process	procid_target
PID 2484 set thread context of 2664	2484	1d2ebab3ed572cc11daf9d4ff90b5e0c_JaffaCakes118.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

1d2ebab3ed572cc11daf9d4ff90b5e0c_JaffaCakes118.exe

pid	Process
2664	1d2ebab3ed572cc11daf9d4ff90b5e0c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

1d2ebab3ed572cc11daf9d4ff90b5e0c_JaffaCakes118.exe

description	pid	Process	procid_target
PID 2484 wrote to memory of 2664	2484	1d2ebab3ed572cc11daf9d4ff90b5e0c_JaffaCakes118.exe	28
PID 2484 wrote to memory of 2664	2484	1d2ebab3ed572cc11daf9d4ff90b5e0c_JaffaCakes118.exe	28
PID 2484 wrote to memory of 2664	2484	1d2ebab3ed572cc11daf9d4ff90b5e0c_JaffaCakes118.exe	28
PID 2484 wrote to memory of 2664	2484	1d2ebab3ed572cc11daf9d4ff90b5e0c_JaffaCakes118.exe	28
PID 2484 wrote to memory of 2664	2484	1d2ebab3ed572cc11daf9d4ff90b5e0c_JaffaCakes118.exe	28
PID 2484 wrote to memory of 2664	2484	1d2ebab3ed572cc11daf9d4ff90b5e0c_JaffaCakes118.exe	28
PID 2484 wrote to memory of 2664	2484	1d2ebab3ed572cc11daf9d4ff90b5e0c_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\1d2ebab3ed572cc11daf9d4ff90b5e0c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1d2ebab3ed572cc11daf9d4ff90b5e0c_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Users\Admin\AppData\Local\Temp\1d2ebab3ed572cc11daf9d4ff90b5e0c_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\1d2ebab3ed572cc11daf9d4ff90b5e0c_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2484-6-0x0000000000CF0000-0x0000000000D54000-memory.dmp

Filesize
400KB

Download
memory/2484-3-0x0000000000610000-0x000000000061C000-memory.dmp

Filesize
48KB

Download
memory/2484-1-0x0000000000E70000-0x0000000000F10000-memory.dmp

Filesize
640KB

Download
memory/2484-0-0x00000000741BE000-0x00000000741BF000-memory.dmp

Filesize
4KB

Download
memory/2484-4-0x00000000741BE000-0x00000000741BF000-memory.dmp

Filesize
4KB

Download
memory/2484-5-0x00000000741B0000-0x000000007489E000-memory.dmp

Filesize
6.9MB

Download
memory/2484-2-0x00000000741B0000-0x000000007489E000-memory.dmp

Filesize
6.9MB

Download
memory/2484-7-0x0000000004940000-0x0000000004970000-memory.dmp

Filesize
192KB

Download
memory/2484-15-0x00000000741B0000-0x000000007489E000-memory.dmp

Filesize
6.9MB

Download
memory/2664-10-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2664-8-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2664-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2664-14-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2664-16-0x00000000008F0000-0x0000000000BF3000-memory.dmp

Filesize
3.0MB

Download